Security audit

Apiclaw Analysis

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its Amazon research purpose, but it needs review because it stores API keys in plaintext and includes weak nationality-inference guidance for sellers.

Review before installing. Prefer setting APICLAW_API_KEY as an environment variable instead of giving the key to the agent or saving config.json. Avoid using the Chinese-seller workflow unless it relies only on verified sellerLocation data, and ask the agent not to infer nationality from names, brands, or product categories.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to infer whether sellers are Chinese from name patterns, brand strings, and product-category stereotypes when location data is missing. That is a sensitive nationality/ethnicity inference from weak proxies, which can produce discriminatory profiling, false attribution, and downstream biased recommendations or analyses unrelated to the legitimate product-research purpose.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill reads credentials not only from the declared environment variable but also from a local config.json in the skill directory. This expands the credential trust boundary and allows undeclared secret ingestion from local disk, which can bypass platform expectations for secret handling and increase the chance of unintended credential use or leakage.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly instructs users to tell their AI agent the API key so it can save it to a config file, but provides no warning about secret handling, storage location, file permissions, or risk of prompt/log exposure. In the context of an agent skill, this is more dangerous than ordinary documentation because agents may persist, echo, transmit, or include secrets in conversation history and telemetry, increasing the chance of credential leakage.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill instructs the agent to write a user-provided API key to a local config file without an explicit warning, consent flow, retention policy, or storage protections. Persisting credentials in plaintext creates a risk of later disclosure to other tools, future prompts, logs, backups, or users sharing the same workspace.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases for comprehensive recommendations are very broad and can match ordinary conversation like 'help me choose,' causing the skill to activate outside clearly intended Amazon product-research contexts. Overbroad activation increases the chance of unnecessary data handling, confusing behavior, and accidental invocation of downstream workflows without sufficient user scoping.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The phrase 'Chinese sellers' is a broad trigger for a workflow centered on nationality-based analysis, with no clear requirement that the user be asking for legitimate market research or compliance-safe aggregation. Because the triggered workflow later includes sensitive inference logic, broad activation makes it easier to enter a discriminatory analysis path from casual or ambiguous prompts.

Natural-Language Policy Violations

High

Confidence: 99% confidence
Finding: The guidance encourages inferring nationality/ethnicity from all-pinyin names, suffix patterns like '-Direct' or '-Store,' and product categories 'typical of Chinese sellers.' This is a classic sensitive-trait inference from proxies and stereotypes, which is unreliable, discriminatory, and especially dangerous because it operationalizes the inference into a repeatable agent workflow.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrase set for risk assessment includes broad language such as 'can I do this' and 'what are the risks', which can match many unrelated user requests outside Amazon product evaluation. In an agentic system, overly generic routing phrases can cause this skill to activate on out-of-scope prompts and unnecessarily invoke external data tooling, creating prompt-routing confusion and increasing the chance of inappropriate data access or misleading responses.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The category consumer insights trigger list contains vague phrases like 'what do users want' and 'who is buying', which are common across many domains and not specific to Amazon seller analysis. Because this skill is designed to call an external API, ambiguous activation criteria increase the risk of accidental invocation for unrelated conversations, leading to unnecessary third-party requests and potentially irrelevant or confusing outputs.

Ssd 3

Medium

Confidence: 99% confidence
Finding: The instruction to store the API key in `config.json` creates a data retention risk because sensitive credentials remain on disk beyond the immediate task. In the context of an API-driven skill that may run repeatedly, this increases exposure through accidental inclusion in context, repository contents, backups, or local filesystem access by other components.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.